[leftmargin=*,nosep]
None. The gradient shared between the server and clients is the full gradient without any defense. This is the most common setting that previous papers focus on.

Sign compression [1]} applies the sign function to each dimension of the gradient independently to compress the gradient to one bit per dimension.

Gradient pruning with pruning rate \(\alpha \) [2]} zeroes out the bottom \(1-\alpha \)  fraction of coordinates of \(\nabla _{\mathbf {w}}\ell (f_{\mathbf {w}}(\mathbf {x}), y)\)  in terms of absolute value, which effectively compresses the gradient to \((1-\alpha ) m\)  dimensions.

Gradient perturbation with Gaussian standard deviation \(\sigma \) [3]} is a differentially private mechanism used commonly for training private models with SGD. An i.i.d. Gaussian random vector \(\mathcal {N}(0, \sigma ^2)\)  is added to the gradient, which one can show achieves \(\epsilon \) -local differential privacy [4]} with \(\epsilon = O(1/\sigma )\) .

